Test Kennung:	1.3.6.1.4.1.25623.1.1.2.2020.1240
Kategorie:	Huawei EulerOS Local Security Checks
Titel:	Huawei EulerOS: Security Advisory for ghostscript (EulerOS-SA-2020-1240)
Zusammenfassung:	The remote host is missing an update for the Huawei EulerOS 'ghostscript' package(s) announced via the EulerOS-SA-2020-1240 advisory.
Beschreibung:	Summary: The remote host is missing an update for the Huawei EulerOS 'ghostscript' package(s) announced via the EulerOS-SA-2020-1240 advisory. Vulnerability Insight: The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.(CVE-2016-7976) psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.(CVE-2018-11645) A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.(CVE-2019-14817) A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.(CVE-2019-14813) A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.(CVE-2019-14812) A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.(CVE-2019-14811) libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.(CVE-2017-9216) Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file, leading to a denial of service (application crash) or possibly execution of arbitrary code.(CVE-2017-7975) Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2_decode_symbol_dict function in jbig2_symbol_dict.c in libjbig2dec.a during operation on a crafted .jb2 file.(CVE-2017-7885) Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'ghostscript' package(s) on Huawei EulerOS Virtualization for ARM 64 3.0.2.0. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7976 BugTraq ID: 95332 http://www.securityfocus.com/bid/95332 Debian Security Information: DSA-3691 (Google Search) http://www.debian.org/security/2016/dsa-3691 https://security.gentoo.org/glsa/201702-31 http://www.openwall.com/lists/oss-security/2016/10/19/6 Common Vulnerability Exposure (CVE) ID: CVE-2016-9601 BugTraq ID: 97095 http://www.securityfocus.com/bid/97095 Debian Security Information: DSA-3817 (Google Search) https://www.debian.org/security/2017/dsa-3817 https://security.gentoo.org/glsa/201706-24 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9601 Common Vulnerability Exposure (CVE) ID: CVE-2017-7885 Debian Security Information: DSA-3855 (Google Search) http://www.debian.org/security/2017/dsa-3855 https://security.gentoo.org/glsa/201708-10 https://bugs.ghostscript.com/show_bug.cgi?id=697703 Common Vulnerability Exposure (CVE) ID: CVE-2017-7975 https://bugs.ghostscript.com/show_bug.cgi?id=697693 Common Vulnerability Exposure (CVE) ID: CVE-2017-7976 https://bugs.ghostscript.com/show_bug.cgi?id=697683 Common Vulnerability Exposure (CVE) ID: CVE-2017-9216 BugTraq ID: 98680 http://www.securityfocus.com/bid/98680 https://bugs.ghostscript.com/show_bug.cgi?id=697934
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.